Memento: When exporting a root certificate (with its private key) from a Microsoft Root CA you get a pkcs#12-file (.pfx). In order to import this cert and key into the Cisco Ironport WSA as a root certificate you need to do this:

1. Move the .pfx-file to a machine with openssl installed
2. Run “openssl pkcs12 -in myinfile.pfx -out myoutfile.pem -nodes
3. When prompted enter the password you used when exporting the cert/key on the CA server.
4. Open the myoutfile.pem file in a texteditor.
5. Copy the lines beginning with (and including!) the line “—–BEGIN CERTIFICATE—–” and until the end of the line “—–END CERTIFICATE—–“.
6. Paste that content to a new file and save it to something like cert.pem
7. Open the myoutfile.pem again in a text editor.
8. Copy the lines beginning with line “—–BEGIN RSA PRIVATE KEY—–” and ending with the line “—–END RSA PRIVATE KEY—–“.
9. Paste the content to a new file and save it to something like key.pem.
10. Select the files as Certificate and Key respective in the WSA GUI under Security Services-HTTPS Proxy-Edit Settings…-Root Certificate for signing-Use Generated Certificate and Key.

I have googled this so many times now. Hopefully google will index this rapidly and next time I google it I will see my own blog post as the first search result. 🙂

Memento is… oh sorry, forgot what to write here…

After reading about sqrl, the qr-based login system invented by Steve Gibson, I started to think about hashed password generators as a light-variant to sqrl.

What if you could have a password generator that always gives you the same output? Think about it. You use the generator that outputs the password of “1LKk23j!2323^dfD” to be used at facebook.com. One year later you forgot that password and you start the same password generator and it gives you the same password again. Great, huh?

In order for it to be secure we have a few requirements though:

1. It needs to be unique per site. That is, I do not want to use the same password on facebook, twitter, amazon and instagram.
2. It needs to be unique per user. I do not want to have the same facebook password as you have.

So, we take 2 inputs to the password generator:

1. Something that is unique per site. The domain name or the site name or whatever. For simplicity say that you enter “facebook” for facebook, “twitter” for twitter and so on.
2. Something that is unique per user. My super secret key. It might be the chassis number of my ex spouse brother´s first car, the first sentence in your favourite book or anything hat you will always remember (and write down, and store it securely!).

We also have to decide the length of the output passwords. I suggest something like 12 characters. It is long enough to not brute force.

I built the password generator as a simple bash script since I have already openssl installed. The script below will do this:

1. ask for the site-specific parameter you want to create the password for (in our example ‘facebook)
2. Ask for your super secret private password.
3. Create a cryptocraphic hash digest of your site-specific password ‘facebook’ with your private key as a… eeeh… private key. 🙂
4. Since the output is binary, all non-printable characters will be removed.
5. The first 12 bytes of the string will be printed on the screen.

#!/bin/bash
export IFS=""
export LC_ALL=C
read -rp "site: " PARAMETER
read -rsp "common private key: " PASSWORD
echo "Password for site $PARAMETER:"
echo "$PARAMETER" \
| openssl dgst -sha512 -binary -hmac "$PASSWORD" \
| tr -cd '[:print:]' \
| cut -c1-12
echo

IANAC (I am not a cryptographer). Not at all. Am I doing this wrong? Can I enhance the security even further? If you have any input in the subject, please write a comment below!

As I wrote above, I did come up with the idea when reading about sqrl. And after googling around the interwebz I quickly realised that all good ideas are already had. The script above is a rip-off of the hashapass cli-version with some improvements. Since I am not using base64 but instead binary output I will get a password with more variety in characters (higher entropy). Also I raised the password length from 8 to 12 characters.